openvas-plugins 1.0.7 (2009-05-28)

This is the last maintenance release of the openvas-plugins module for the Open
Vulnerability Assessment System (OpenVAS).

As it was agreed in Change Request #32
(http://www.openvas.org/openvas-cr-32.html), the OpenVAS project will no longer
release tarballs of the openvas-plugins module. The NVTs contained in the
openvas-plugins module will continue to be available through the OpenVAS NVT
Feed and as a separate daily updated tar-ball. Please read the Change Request
for details.

The synchronization script and the remaining "C-Plugins" (suffix .nes) will be
migrated to the openvas-server module and will be released with this module
starting with openvas-server 2.1.0.

Please note that this module is no longer needed if you have installed
openvas-server 2.1.0 or newer.

This release fixes various issues discovered after the release of
openvas-plugins 1.0.6 and adds a large number of new Network Vulnerability
Tests (NVTs), now in total over 11,000. Some NVTs are being reactivated by
adding mandatory dependencies - these dependencies were missing because they
were subject to proprietary licensing and thus were not inherited from Nessus.

Shortly after release date of this version, it will be outdated in terms of
NVTs. NVTs are being updated daily. We strongly recommend that you do an
synchronization using the openvas-nvt-sync command before you (re-)start the
OpenVAS server. This will download the latest NVTs from the OpenVAS NVT Feed.

If you are packaging this module for a distribution, we recommend that you
include a synchronization in you post-installation routine.

Main changes since 1.0.6:

* More than 1,000 new NVTs have been added.
* A large number of existing NVTs have been updated and improved.
* The Debian packaging files have been updated.
* The synchronization script (openvas-nvt-sync) again preserves timestamps
  when synchronizing.
* The Local Security Checks Generator (LSC-Generator) is now able to generate
  LSCs for Gentoo and HP-UX as well.
* A number of NVTs using the tool "hydra" have been removed from openvas-plugins
  due to licensing issues. Please refer to the ChangeLog for details.

Many thanks to everyone who has contributed to this release: Chandrashekhar B,
Christian Eric Edjenguele, Goran Licina, Michael Meyer, Thomas Reinke, Chandan
S, Markus Schröder, Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller


openvas-plugins 1.0.6 (2009-04-09)

This is a maintenance release of the openvas-plugins module for the Open
Vulnerability Assessment System (OpenVAS).

It fixes various issues discovered after the release of openvas-plugins 1.0.5
and adds a large number of new Network Vulnerability Tests (NVTs), now in total
over 10,000. Many NVTs are being reactivated by adding mandatory dependencies -
these dependencies were missing because they were subject of proprietary
licensing and this were not inherited from Nessus.

If you are using openvas-plugins 1.0.2 or earlier we strongly recommend that you
upgrade to openvas-plugins 1.0.6. Openvas-plugins 1.0.2 and earlier contains a
bug which results in plugins having incorrect ownership information after
synchronization with openvas-nvt-sync. Depending on your configuration, this may
result in plugins being writable by a normally unprivileged user. This issue is
currently rendered ineffective by a workaround of the OpenVAS Feed Server, but
this workaround may be removed in the near future. Openvas-plugins 1.0.3 or
later is unaffected by this issue.

Effects when installing this version:

* A number of NVTs have been adjusted to provide inform if they were unable to
  complete their checks instead of failing silently. This may lead to larger
  reports depending on your individual configuration.
* The synchronization script (openvas-nvt-sync) no longer preserves timestamps
  when synchronizing. This may cause the synchronization to take slightly longer
  depending on your installation.
* Several so-called "C-Plugins" (suffix .nes) have been replaced by NASL equivalents.
  If you want to remove these deprecated NVTs, you should eliminate any *.nes file
  from your plugins directory before installing the new openvas-plugins 1.0.6.
* If you are applying openvas-nvt-sync to be in sync with the OpenVAS NVT Feed,
  then you already have most of the changes and updates in your plugin
  directory. However, you should take care of removing the superfluous
  "C-Plugins" (see above).

Main changes since 1.0.5:

* More than 4,000 new NVTs have been added.
* A large number of existing NVTs have been updated and improved.
* The build environment has been updated.
* The plugin_feed_info.inc file has been removed from the openvas-plugins module
  since it has been returned to its real purpose and is provided by security
  feed providers now.
* A generator for Local Security Checks has been added. This tools was used
  to create NASL-scripts for OpenSUSE, Ubuntu, RedHat, Fedora back to January
  1st, 2007.
* Support for the improved SSH credential management available in openvas-server
  2.0.1 and later has been added.
* openvas-plugins can now be configured and installed without the
  --enable-install configuration option.
* An install-minimal target has been added to the build target. This target will
  install openvas-plugins without any *.nasl and *.inc files which is useful for
  testing purposes or when synchronization with a security feed will occur
  anyway after installation.
* Obsolete inline signatures have been removed from files which still contained
  them.
* A number of obsolete NASL_LEVEL checks have been removed.
* The following NVTs written in C have been replaced with NASL scripts:
  - ftp_write_dirs (by ftp_writeable_directories.nasl)
  - linux_tftp (by tftpd_detect.nasl and tftpd_dir_trav.nasl)
  - smad (by remote-smtp-smad.nasl)
  - nmap_wrapper (by nmap.nasl)
  - objectserver (by remote-sgi-objectserver.nasl)

Many thanks to everyone who has contributed to this release: Chandrashekhar B,
Tim Brown, Christian Eric Edjenguele, Vlatko Kosturjak, Michael Meyer, Thomas
Reinke, Chandan S, Jan-Oliver Wagner, Michael Wiegand and Felix Wolfsteller


openvas-plugins 1.0.5 (2008-12-03)

This release is a maintenance release with an updated NVT collection.

As with all openvas-plugins releases, it is recommended that you execute the
openvas-nvt-sync tool provided by the openvas-server component after installing
this release to ensure that your OpenVAS installation has access to the latest
NVTs.

Main changes from 1.0.4 are:

* A large number of new NVTs has been added.
* A large number of new NVTs has been updated.
* Several NVTs written in C have been updated to improve their 64-bit
  cleanliness and to build more reliable. This introduces a new dependency on
  glib to openvas-plugins.
* Improved host OS detection when gathering package information from a remote
  host.
* Various bugfixes.
* Code cleanup.
* Updated packaging for Debian.

This release contains contributions by:

Tim Brown
Hanno Boeck
Chandrashekhar B
Stjepan Gros
Vlatko Kosturjak
Thomas Reinke
Joey Schulze
Jan-Oliver Wagner
Michael Wiegand


openvas-plugins 1.0.4 (2008-10-27)

This release is a maintenance release with an updated NVT collection.

As with all openvas-plugins releases, it is recommended that you execute the
openvas-nvt-sync tool provided by the openvas-server component after installing
this release to ensure that your OpenVAS installation has access to the latest
NVTs.

Main changes from 1.0.3 are:

* Several NVTs written in C have been removed from openvas-plugins since they
  have been superseded by other scripts written in NASL and were inactive for
  a long time (nmap_tcp_connect, hydra, snmp_portscan).
* The integration of other security tools has been improved (ike-scan, hydra),
  support for additional tools has been added (strobe).
* A large number of non-functional tests for Gentoo security issues with an
  unclear license have been replaced with updated, working NVTs licensed under
  the GPL2.
* A large number of new NVTs has been added.
* A large number of new NVTs has been updated.
* Support for retrieving package version information from a remote host has been
  improved.
* Some GPLed NVTs that were part of the last Free Nessus feed release were
  added.

This release contains contributions by:

Tim Brown
Chandrashekhar B
Carsten Koch-Mauthe
Vlatko Kosturjak
Thomas Reinke
Jan-Oliver Wagner
Michael Wiegand


openvas-plugins 1.0.3 (2008-09-17)

Maintenance release with a considerable number
of new (1000+) and improved NASL scripts.

It is recommended to update your installation
with this package because it also contains an
updated feed synchronisation script.

Main changes are:

* Full support for FreeBSD (local security checks)
* Many new vulnerability checks across several families for current
  security issues. Among this many Windows local security checks.
* Fixes for several NASL libraries (mostly .inc files) in order
  to re-enable proper functionality for large number of NASL scripts.
* Reimplementations for some NASL suport routines that were proprietary
  with Nessus.
* Reactivation of license-clarified NASL libraries, e.g. for
  SMB checks.
* Extension for RPM-based systems to allow for package signatures tests
  (this prepares support for OVAL-based checks)
* Many new Debian local security checks (complete and up-to-date)
* All tcp scanners have been reviewed and improved, support for ike,
  pnscan and portbunny is added.
* Improved Debian packaging files.
* Internal consolidation for Knowledge Base entries (especially package
  information for local security checks)
* Updated license auditing routine (internal use)
* Obsolete C plugin "tftp_grab_file" removed.

This release contains contributions by:

 Chandrashekhar B
 Tim Brown
 Christian Eric Edjenguele
 Javier Fernandez-Sanguino
 Carsten Koch-Mauthe
 Vlatko Kosturjak
 Thomas Reinke
 Jan-Oliver Wagner
 Michael Wiegand


openvas-plugins 1.0.2 (2008-06-23)

Maintenance release with some fixes,
new scripts and cleanups.
It is recommended to update your installation with
this release to get rid of a ugly behaviour of the
snychronisation routine (see below).

Apart from this, Nikto users will get an improved
and updated NASL script to comfortably run
Nikto via OpenVAS.


Main changes are:

* Bugfix in "openvas-nvt-sync": Wrong quoting in this script
  created strange directory structure in OpenVAS server installation.
  This is fixed now.
  In case you started this script as shipped by openvas-plugins 1.0.1,
  you should manually remove the directory, e.g.:
  # cd /usr/lib/openvas
  # ls -l             (watch-out for the directory named '"')
  # rm -rf \"

* 8 new Debian Local Security Checks
  contributed by www.securityspace.com

* 6 new Windows Local Security Checks and generic
  Linux Security Checks, by DN-Systems.

* Updated integration of Nikto: Adaptions for new Nikto 2.0
  and further improvements to run Nikto via OpenVAS (nikto.nasl).
  Also, the obsolete C-Plugin for Nikto (nikto.nes) has now been finally
  removed.

* Improved framework for Windows Local Security
  Checks based in smbclient.

* Various other small fixes.


openvas-plugins 1.0.1 (2008-06-04)

Maintenance release with several new
scripts, some package restructuring
and packaging support.

Outstanding is the up-to-date Debian
Local Security Checks, the newly developed
base funcationality for writing Windows
Local Security Checks and the new base
functionality for generic software version
tests.


Main changes are:

* 118 additional Debian Local Security Checks
  Contributed by www.securityspace.com

* New: Windows local security checks via smbclient
  added. The new base library is smbcl_func.inc.
  A sample test is win_CVE-2007-0043.nasl.
  The old Nessus Windows Local Security Checks
  were removed because the base library was under a propritary
  license.

* New methodology to test for software
  version on a remote host by asking the
  actual software rather than the RPM/DEB
  package database (version_func.inc).
  clamav-CB-A08-0001.nasl (CVE 2007-6335,
  CVE 2007-6336, CVE 2007-6337) as a sample
  how this is works.
  This makes it possible to check for tools
  that were not installed via the package
  management (typical for many services).
  Additionally, the tests are to some extend
  independent of the operating system of the
  targets.

* openvas-nvt-sync now less verbose. PID file location fixed.

* Debian packaging files moved from debian/ to packagig/debian.

* New: sample RPM spec files for SUSE and Fedora.

* Several bug fixes in .nasl and .inc files.

* Removed several obsolete files and docs
  (e.g. "nessus-update-plugins.in").

* Plugin Factory removed. See also:
  http://www.openvas.org/openvas-cr-3.html
  Packagers: You do not need to consider
  the plugin factory installation files/dirs.

* Several .inc NASL files from older Nessus
  distributions added (the old versions were under
  GNU GPL while the new ones are not in OpenVAS
  because they switched to a proprietary license).

openvas-plugins 1.0.0 (2008-02-05)

First stable release with only minimal changes
compared to latest 0.9 version (except for extensive
updates on NASL scripts).
Almost no problems or any sort of issues have been
reported for over two months now.
This release is done basically
to reach the mentally important version 1.0,
there is no technical need to replace openvas-plugins
for a running installation in case the OpenVAS NVT
feed is used to retrieve new NASL scripts (NVTs).


Notes for upgrading from previous versions:

The old NVT files debian_DSA* are not automatically removed
from your installation during synchronization with the feed
and neither with installing this new release.

They do no other harm than doubling the number of alerts during
a scan. Simply remove the files from your installation
(located by default in /usr/lib/openvas/plugins). In doubt,
please contact the OpenVAS developers mailing list.


Main changes are:

* Removed any old debian_DSA-*.nasl NVTs and replaced by new
  deb_*.nasl as provided by SecuritySpace. In contrast
  to the old set, the new one is complete and uptodate (DSA 1478).
* Some new generic NASL routines to support the Debian local
  security checks.
* Sync-routine for OpenVAS NVT Feed improved to be independent
  of the current working directory.
* Minor improvement of internal licensing auditing routine of
  the package files.


openvas-plugins 0.9.1 (2007-11-07)

Comprehensive cleanup and completion release: Cleanup Network Vulnerability
Tests (NVTs) regarding legal issues, add feed service
synchronization script and ensure the NVT group "Debian
Local Security Checks" works.

Main changes are:

* Added a fetch tool to retrieve updated NVTs from
  a feed server: "openvas-nvt-sync"
* Ensured that the group of Debian local security
  checks can execute (replaced any non-free component
  by a GPLed one).
* Updated Debian local security checks from
  nessus-plugins 2.2.10 (upto DSA 1320).
* Removed any .nasl and .inc script which is
  or might be non-free.
* Added NVTs to manage SLAD (Security Local Auditing).
* Internal audit shell script to test whether non-free
  scripts remain and which scripts to not execute
  anymore due to missing (because non-free) .inc files.
* Debian packaging files added.
* Extended package configuration routine to check for
  minimum versions of openvas-libraries and openvas-server.
* Minor fixes in Makefiles.

openvas-plugins 0.9.0 (2007-07-28)

The first initial release of openvas-plugins
after the fork from Nessus 2.2.x.

Main changes are:

* Many improvements to the plugins
* Some changes necessary in the frame migration from
  OpenSSL to GNU/TLS
* Many cleanups of ancient remains (still many to come)
* Lots of renaming to avoid conflicts with parallel
  Nessus installation
